Security review packages
Reports, receipts and packages you inspect offline. Requested through a non-secret fit check — there is no external portal or self-serve checkout on the buyer path.
Packages name what was checked, which evidence supports it, which hosts or systems were authorised, and what remains outside scope. They do not launch an OffSec portal, move funds, collect secrets, or certify compliance.
Bounded local checks on authorized servers. Posture evidence, report, receipt, and manifest you inspect.
What does an authorized local host show right now?
A paid pilot for one authorised public-facing domain or application, with manually reviewed outside-in findings, explicit unknowns, and an inspectable handover package.
Evidence collection and review for SaaS, Web3, and protocol teams. Findings, drift, and proof-pack.
What is checked before launch, and what remains outside scope?
Read-only posture on wallet ops and custody setups. Receipted deliverables. No fund movement.
Where does custody or wallet-ops authority stop?
Assess, collect evidence, produce readiness report and receipt trail. Bounded, local-first.
What do we know, infer, and still not know after an incident?
Fixed-fee entry: 1 operator, ~10 hosts, 2 runs (baseline + drift), 1 proof-pack per host, 1 review session.
Can we try a bounded proofpack set before a larger program?
Recurring bounded collections and reviews. All receipted.
Can recurring agreed scopes get fresh receipt trails?
Help set up your own receipted collection and verification pipeline (agent + shield tools).
Can we set up our own receipt and verification pipeline?
Start a review
Primary route: /review/request
Fallback contact: engage@mail.witnessops.com
Do not send passwords, private keys, API keys, recovery codes, session tokens or other secrets.